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Introduction 


The Data Protection Commission (DPC) is the national independent authority in Ireland responsible 
for upholding the fundamental right of individuals in the European Union (EU) to have their personal 
data protected. Accordingly, the DPC is the Irish supervisory authority responsible for monitoring the 
application of the General Data Protection Regulation (GDPR) and we also have functions and powers 
related to other regulatory frameworks, including the Irish ePrivacy Regulations (2011) and EU 
Directive 2016/680 of the European Parliament and of The Council known as the Law Enforcement 
Directive (LED). The statutory powers, duties and functions of the DPC are as established under the 
Data Protection Act 2018, which gives further effect to the GDPR, and also transposes the LED. 


The DPC, in meeting the demands of the tasks assigned under the GDPR and to deliver public value in 
what is an area of critical importance to society, has now set out its funding request for the fiscal year 
2020. In order to underpin delivery of our mission, including delivery of a 5-year regulatory strategy 
that challenges behaviours, delivers substantive compliance and meets consumer expectations, the 
fiscal year 2020 will be another key year to deliver on GDPR for all our national and international 
stakeholders. 
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The role and responsibility of the Data Protection Commission is wide ranging and diverse. Article 57 
of the GDPR stipulates that supervisory authorities have 22 tasks for which they are responsible. These 
include monitoring and enforcing the application of the GDPR; promoting public awareness 
particularly in the context of children; promoting the awareness of controller and processors of their 
obligations; advising Member State governments and public institutions on legislative and 
administrative measures relating to personal data processing; handling all complaints and 
investigating these to the extent appropriate; cooperating with and providing mutual assistance to 
other EU data protection authorities and contributing to the European Data Protection Board 
(especially applicable to the DPC in the context of the One Stop Shop); conducting investigations 
including on the basis of information received from other data protection authorities (again very 
relevant to the DPC in the context of the One Stop Shop); encouraging the development of codes of 
conduct and the establishment of data protection certification mechanisms; and approving binding 
corporate rules applications submitted by companies. 


All of these functions are increasingly contributing to significant increases in the volume of matters 
the DPC is statutorily mandated to progress and manage in an efficient and timely manner. In 
particular, given the role of the DPC as a Lead Supervisory Authority, the office carries a 
disproportionate burden of the EU's collective effort to regulate the data processing activities of global 
tech giants which are active in the European market. In addition, it must be acknowledged that the 
DPC is also responsible for regulating all private, public and voluntary entities and bodies in Ireland 
that process personal data, amounting to hundreds of thousands of organisations. Positioning and 
structuring the DPC to best perform its functions has necessitated the establishment of some 17 
functional areas. While all areas are staffed according to their role and needs vis a vis other functional 
areas taking into account organisational priorities, caseloads (complaint handling and inquiry teams 
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will have considerably more staff than the strategy and operations section for example) and 
complexity of the issues for which each area is responsible for managing. 


Since 25 May 2018, 20 large-scale inquiries into technology, social media and internet platform 
multinationals have been commenced at the DPC, with additional inquiries being prepared for 
commencement. The matters being investigated are complex and relate to core aspects of the 
business models of these companies. Depending on the conclusions of the DPC's investigations, the 
business and operational implications of the DPC's findings could be far-reaching. Accordingly, these 
inquires must be progressed thoroughly, fairly and in line with all procedural safeguards to protect 
the integrity of the process. While every effort is made to conclude inquiries as expeditiously as 
possible, conducting the investigative and analysis steps, and ensuring the parties are afforded the 
right to be heard at multiple points in the inquiry process, means that the process cannot be summarily 
concluded and can take six to twelve months to complete. This is substantially longer, and requires far 
more effort, than had been anticipated in the context of the DPC's workforce planning before the 
application of the GDPR. In this regard, it is informative to take into account other data protection 
authorities' experience in running large-scale investigations. One recent significant investigation by 
the French data protection authority into a multinational company took 220 working days, mobilising 
23 people, while the UK Information Commissioner's Office's investigation into matters arising from 
the Cambridge Analytica affair involved c. 60 staff in the investigation. 
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1. Rationale for increased DPC 2020 funding 


The first year of application of the GDPR (from the end of May 2018 to the end of May 2019) 
has provided the DPC with concrete statistics on volume and scale that now underpin its budget 
demand for 2020. 

Complaints (now coming to the DPC from consumers across the EU and the handling of which is 
mandatory for the DPC) have more than doubled in number since 2017 (being 251% of registered 
complaints in 2017) and have increased in complexity; breach notifications to the DPC that necessitate 
specific assessment in each case have also more than doubled since 2017 (being 208% of registered 
breaches in 2017) in addition to which the enforcement role the DPC is assigned under the GDPR has 
led to the opening of a large number of investigations requiring dedicated and skilled resources. 
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While the DPC acknowledges the budget increases Government has committed over the last four 
years, the use of which it has sought to maximize in terms of outputs, the DPC has equally been clear 
that the starting point in 2014 was an extremely low base from which to build. Today the DPC is the 
7th largest EU data protection authority in budgetary terms, 8th in terms of staffing. It is arguable the 
DPC should be the largest given the unique role of Ireland and the DPC in lead-supervising for the 
EU the world's largest tech platforms under the GDPR. As a comparison, the ICO in the UK currently 
has staffing levels of approximately 700 staff and a budget of almost €61.OM for 2019, the French DPA 
(CNIL) has approximately 208 staff with a budget of €19.OM, the Italian DPA has staffing levels of 170 
and budget of €29m, and the Dutch Authority has a staffing level 172 with a budget of €20.OM. 
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The scrutiny of Ireland and the DPC has never been greater. International media coverage of the DPC 
is high with the Wall Street Journal, New York Times, Reuters, Bloomberg, the Washington Post, 
Politico and the Financial Times, amongst others, all regularly covering DPC news and opining on the 
Irish DPC position in the context of EU and global data protection regulation. Not all of the coverage 
is positive and photographs of the DPC "over a supermarket" in Portarlington are still published with 
commentary suggesting Ireland is not serious about data protection regulation, regularly citing staff 
and budgetary comparisons with other EU DPAs. While the DPC considers such commentary to be 
largely illegitimate given the investment by Government in the authority in recent years, and given 
the DPC's demonstrated commitment to the highest standards of regulation, the criticism is not 
always easily countered in circumstances where the DPC is outflanked by several much larger 
authorities in the EU who have a fraction of the oversight responsibility of the DPC, as demonstrated 
now by the factual scenario post-GDPR. 


The Data Protection Act, 2018, Section 25, requires that the Commissioner, or Chairperson of the 
Commission, be the accounting officer for the DPC. Currently, the Secretary General for the 
Department of Justice and Equality (DJE) is the DPC's accounting officer as the organisation falls within 
the Department's Vote. It is envisaged that the DPC will transition to becoming its own accounting 
officer with its own separate vote from 1 January 2020. The transition to the DPC's own accounting 
officer will have a significant impact on the administrative and fiduciary obligations of the DPC 
including HR, finance, procurement, governance, IT, and corporate services. 


The new legislative regime has placed increased EU and international burdens on the DPC. Arising 
from the cooperation and consistency mechanisms under GDPR, staff of the DPC are required to 
participate in meetings of the newly-established European Data Protection Board (EDPB) and 
meetings of its twelve subgroups. This places an increased burden on the resources of the DPC as it 
attended approximately 120 in-person meetings in Brussels since May 2018. The DPC staff have 
contributed to the development of guidelines, working materials and draft procedures across all of 
the EDPB subgroups. In addition, the DPC has increased its engagement with international 
organisations and supervisory authorities outside of the EU to share information and practices in the 
context of enforcement and other regulatory activities. 


The DPC is monitoring closely the outcome of the discussions on Brexit. A no-deal Brexit will have an 
impact on the work of the DPC as it is anticipated that further companies will move main 
establishments for data protection purposes to Ireland, meaning that the DPC will become their Lead 
Supervisory Authority under the One Stop Shop model in the GDPR. 


The DPC has now identified that it requires substantial additional staff resources to handle in particular 
the volume of complaints, breaches and investigations it needs to run under the GDPR. It is worth 
reiterating that the DPC is not a sectoral regulator but rather has supervision responsibilities in respect 
of every type of organisation. In drawing up its staffing demand it has made efforts to ensure the 
demand looks to the lowest grades possible that the DPC considers feasible in terms of the complexity 
of the roles. For this reason, the staffing demand largely focuses on HEO grade and below. The 
DPC, therefore, based on needs identified by the volumes, statistics and qualitative information set 
out in this submission, asserts a requirement for a considerable additional budget to support the 
hiring of new staff and skills, to complete key infrastructural projects, and to fund the litigation to 
which the DPC is increasingly a party. 
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2. Overview of DPC Budget 2020 Funding Requirement 

In assessing the overall DPC staffing requirement for 2020, careful consideration must also be given 
to the breadth and depth of organisational that is required to enable the DPC to perform its many and 
diverse functions. A detailed outline of DPC's projected funding requirement for 2020 is set out in 
Appendix II. A summary is as follows: 


Table 1 - DPC Budget 2020 Submission Summary - Pay & Non-pay 


SUMMARY 

Budget 2019 

2020 Estimates 

Requirements 

Additional 
Funding (above 
2019) 

Variance 


€ 

€ 

€ 

% 

Pay: 

8 , 916,000 

13 , 390,525 

4 , 474,525 

50% 

Non Pay: 

6 , 364,000 

7 , 803,317 

1 , 439,317 

23% 

Overall Total: 

15,280,000 

21,193,842 

5,913,842 

39% 


As part of the 2020 budgetary process, additional funding of C5.914M (C4.475M on pay and C1.439M 
on non-pay) is sought by the DPC. This would bring the DPC's total allocation to C21.194M (total pay 
C13.391M and non-pay C7.803M). 


2.1 Pay Allocation Requirement 2020 


Throughout 2016, 2017, 2018 and 2019, recruitment has been a key organisational priority for the 
DPC. During these years, the substantial portion of the DPC's increased yearly allocation has been 
directed towards its pay budget, in order to increase the DPC's staffing from a very low base of c.40 
staff in 2015. In Budget 2019, the DPC received a pay allocation of C8.916M to continue to increase 
the total organisational staffing levels. The DPC had requested a staffing level of 180 staff by the end 
of 2019 to fulfil specific and critical regulatory posts. Due to the highly competitive landscape for 
specialist skills as of mid-June 2019, the DPC's total staff number had increased to 132 staff, with the 
expectation that this will increase to 148 staff by the end of 2019. The target of 148 staff will result in 
the utilisation of the 2019 sanctioned pay budget (C8.916M.) On this basis, additional pay allocation 
of C4.475M (total a pay allocation in 2020 of C13.391M) will be required to fund the target staffing 
levels of 224 staff. Dedicated DPC recruitment campaigns are currently in train with the Public 
Appointments Service, supported bythe Department of Justiceand Equality's Human Resources team. 
From these campaigns, the DPC will establish various panels, including PO Head of Regulatory Activity, 
AP Senior Regulatory Lawyers, HEO Business Systems Analysts, and HEO Legal Researchers. 

The increased pay allocation will facilitate, in 2020, the ongoing recruitment of a further 76 staff. The 
DPC will continue to use the expert and other relevant panels established in 2019 to hire a number of 
these additional staff who will have expert and specialist skills in legal, investigations, technology and 
data protection where these skills are required. Other generalist staff will be recruited through Public 
Appointments Service panels and other available panels, where applicable. It is the intention of the 
DPC under its new HR and Accounting officer responsibility to examine policies in relation to the 
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retention of staff, particularly professionally skilled staff and the possible use of the higher scales of 
the salary scales across the relevant grades. 

The proposed increase in DPC staffing will be critical in light of the DPC's significantly greater 
regulatory role under the GDPR and the Law Enforcement Directive. As the DPC regulates across all 
sectors, the organisation requires staff with a wide range of skills and experience, including emerging 
technologies and legal specialists and it is important that the DPC continues to build the expertise of 
its staff. Even at these early stages of GDPR implementation, the DPC is seeing a significant increase 
in workload associated with breach notifications, and a substantial increase in the number of 
complaints, calls and emails to our information service daily. As complaints progress through the case 
pathway set out in the Data Protection Act 2018, namely into amicable resolution, complaint handling, 
inquiries and investigations, decision-making and sanctioning, this workload will only increase. The 
combined volume and complexity of this work and the high standard of fair procedures required 
means that DPC will need to continue to grow its staffing. 

Furthermore, importantly, the DPC has seen a significant number of major complex cross-border 
complaints being transferred to the DPC under the One-Stop-Shop model set out in the GDPR. 
Complaint-handling and investigation of cross-border complaints constitutes a substantial increase in 
the workload for the DPC in light of the large number of multi-national technology companies that are 
established in Ireland. Related to this, the new One-Stop-Shop structure under the European Data 
Protection Board requires significant input from the DPC with rigorous obligations set out in the GDPR. 
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Pay Allocation Requirement per DPC Function 


DPC Senior Management Committee & Organisational Structure 



DPC Senior Management Team 

The DPC seeks to broaden its senior management team in order to effectively deliver on its expanded 
remit as its own accounting officer, its role as lead supervisory authority for technology platforms, its 
functions of oversight, and management of its increased number of staffing resources. Accordingly, 
the DPC seeks an additional Head of Regulatory Activity at PO level in addition to a Head of 
Organisational Effectiveness. 

The Head of Regulatory Activity post is crucial if the DPC is to maximise the outputs from the resources 
it has and will be allocated to ensure that best value for money is delivered on what is invested in the 
DPC. The role will provide the strategic and operational oversight, leadership, and management of 
enforcement and supervision functions to include achievement of the effective, efficient and timely 
delivery of a programme of statutory inquiries, investigations and prosecutions in line with the GDPR, 
Data Protection Act 2018, ePrivacy legislation and other legislation under which the DPC has statutory 
regulatory functions. This leadership role will ensure effective and timely management of a large, 
varied and complex caseload of regulatory inquiries and investigations, designing and delivering 
effective DPC programmes for statutory supervision of organisations across all sectors, driving a 
programme of ongoing quality improvement in complaint-handling, inquiry and investigation 
processes. In addition, this role is crucial in building effective and appropriate working relationships 
with other EU data protection authorities (DPAs) whilst supporting the Commissioner and working 
closely with other Deputy Commissioners. 

The Head of Organisational Effectiveness will be responsible for designing and implementing a DPC 
People Strategy, such that the DPC is as well-positioned for the future as possible, with a working 
culture that reflects the organisation's values. The post will ensure that organisational and other 
changes stemming from the DPC's Regulatory Strategy are implemented, measured and reported. It 
will also ensure that the various parts of the organisation are well-coordinated, resources are 
apportioned at the right levels, and DPC staff are collaborating productively with each other. Finally, 
this post will ensure that high-quality HR services are delivered to DPC employees and managers, and 
the DPC is fulfilling its employer obligations. 


9 









Technology, Multinational Supervision & Investigation Technology Leadership 
(TMSITL) Division 

In order for the TMSITL Division to fulfil its essential investigatory duties, the section will need to 
recruit Lead Investigators, at Assistant Principal level. These roles will enable the DPCto better manage 
its growing inquiry case load in the interests of the timely and efficient progress and conclusion of 
inquiry reports. 

To support the Lead Investigators in conducting inquiries, as well as taking a lead role for certain 
complaint based inquiries, a number of Higher Executive Officers will need to be recruited to bolster 
the capacity of the breach notification and inquiries team. In particularly, the HEO roles will be 
responsible for: drafting of inquiry reports; supporting the supervision function providing additional 
capacity to facilitate the speedier conclusion of supervision and consultation matters, including the 
drafting of supervision outcome and recommendation reports; and for the Technology Leadership 
Unit to further strengthen the role and capacity of that unit to deliver internal and external guidance 
on technology related matters. 

The technology multinational complaints handling team will recruit at Executive Officer level to enable 
the more timely response to multinational-related enquiries, and the timely progression of complaint 
handling processes, including amicable resolution and the preparation of case files for further 
investigative consideration. In addition, Executive Officer and Clerical Officer roles will be required to 
support inquiry teams in the management of inquiry documentation and preparation of inquiry 
reports, enabling APs and HEOs to focus on substantive matters, and to support breach notification 
handling and assessment. 

Finally, within the Consultation section, there is an additional requirement to recruit at Higher 
Executive Officer level to provide additional capacity in responding to an increasing and more complex 
volume of legislative, law enforcement, and public and health sector consultation requests, as well as 
providing for greater capacity for proactive engagement across all sectors. 
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Strategy, Operations & International Division 

The Strategy, Operations & International Division mainly covers four key areas of importance to the 
DPC: regulatory strategy, operational performance, international affairs and one-stop-shop 
operations, and codes of conduct and certification. Each of these areas requires a DPC-wide 
coordinated approach to ensure organisational consistency and rigour, as well as extensive external 
engagement. 

The Operational Performance unit leads the DPC's multi-year projects to replace its case management 
systems and website, which have been designed to underpin the robust and rigorous procedures 
required under the GDPR and the Data Protection Act 2018. Efficient and reliable systems are critical 
to the DPC's delivery of its regulatory work, given the increased volumes and complexity that have 
resulted from the GDPR. By 2020, this unitwill be supporting the newly-live case management systems 
in use across the DPC, as well as continuing with the implementation of Phase 2 of the programme. 
Phase 2 will ensure that the full benefits of the investment to date are being realised, particularly on 
management information reporting and key performance indicators. Therefore, there is a need to 
build overall unit capacity in process and workflow mapping, procedures and manuals currency, 
project management of continuous improvement initiatives, data-driven quality assurance of case 
management processes, information accuracy, and ongoing regression testing to protect the integrity 
of the live system. 

The International Affairs and One Stop Shop Operations unit ensures that the DPC meets its 
obligations for extensive and iterative information-sharing with other EU data protection supervisory 
authorities, as stipulated under the GDPR's Cooperation and Consistency mechanisms, particularly for 
cases in which the DPC is the Lead Supervisory Authority. As the DPC's hub for all communications on 
these cross-border cases, this unit processes a very high transaction volume, with those volumes 
already exceeding the projections that were made by the DPC in 2018 and indeed by the EDPB. This 
communication takes place over several channels, including two separate central information 
exchange platforms provided by the EDPB, email, telephone and in-person meetings, requiring 
significant coordination. The GDPR Cooperation and Consistency mechanism sets out stringent 
turnaround times and deadlines, for the various mechanisms that can be deployed, from Voluntary 
Mutual Assistance Requests through to Dispute Resolution and Urgency Procedures. While the DPC 
must meet these deadlines by law anyway, constructive and timely engagement with other data 
protection supervisory authorities is a critical factor in the DPC's long-term success and effectiveness 
as the Lead Supervisory Authority for the big technology firms that it regulates on behalf of the EU. 

Due to the operational constraints of the central information exchange platforms, many of these 
transactions require that the DPC communicate formally and separately with each of the other 31 
members of the EDPB (27 EU, 3 European Economic Area and the European Data Protection 
Supervisor). Furthermore, as the implementation of the Cooperation and Consistency mechanisms 
has evolved, the extent and types of information-sharing required by other EDPB members is much 
broader than was originally anticipated, for example, on data breach notifications, amicable resolution 
outcomes and more general updates. The level of coordination required to facilitate Joint Operations 
with other data protection authorities, as the DPC is obliged to do, is also much greater than originally 
anticipated. 
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Taking account of the increased volumes, the greater types of communication, and the operational 
challenges of working across multiple platforms set out above, the One-Stop-Shop Operations team 
requires additional EOs and COs to bolster the existing team and to ensure that the DPC continues to 
deliver against its obligations on information-sharing. 

2020 will be the first year of implementation for two separate initiatives under this Division. The DPC's 
new regulatory strategy will begin its implementation from the start of the year, following extensive 
consultation and strategic analysis on the DPC's priorities over the next five years. 2020 will also be 
the first full year of implementation of the new voluntary accountability mechanisms introduced by 
the GDPR, based on codes of conduct and certification schemes. 
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Legal Division 


The DPC's Legal Division operates horizontally within the DPC and is responsible for legal oversight 
and the provision of internal legal advice and support across all of the DPC's functions, and in respect 
of all litigation in which the DPC is involved. The Legal Division also provides training on a rolling basis 
to all staff within the organisation on a wide range of issues including the applicable legal frameworks, 
legal developments and the performance of the DPC's functions at national and EU levels. Additionally, 
the Legal Division now also encompasses policy development, with specialist senior policy officers 
appointed in late 2018 in the areas of Children's Policy, and Guidance & Policy Development. 

The Legal Division requires additional resources in order to be able to effectively carry out its duties, 
the scope of which have expanded exponentially since the advent of the GDPR. Additional AP Senior 
Legal Advisors and Regulatory Lawyers are required in order to (1) keep pace with the continuing 
increase in demand for legal advice across the organisation due to emergence of novel and complex 
legal issues under the GDPR and the Data Protection Act 2018, (2) keep pace with the significant 
increase in the number of challenging and high-profile investigations and inquiries being launched by 
the DPC, and (3) effectively provide the legal expertise required in carrying out these complex 
investigations and inquiries, and drafting and finalising decisions, including adjudicating on the 
exercised corrective powers in the context of investigations. Given the potential for the exercise of 
the DPC's powers to have far-reaching consequences for organisations which are the addressees of 
such powers, adherence to fair procedures at both national administrative/constitutional law level 
and EU law (e.g. under the right to good administration) is critical to the DPC's proper and lawful 
performance of its functions and to ensuring that there is a sound and sustainable basis in law for all 
findings of fact, findings of law and any resulting exercise of corrective powers. In light of the essential 
requirements that fairness, compliance with natural and constitutional justice and fair procedures are 
embedded into every step of the DPC's investigatory activities, the DPC has a strong requirement for 
additional legal advisors at AP level. Additional HEO Legal Researchers are also required to support 
the legal advice function by carrying out fundamental legal research which will allow legal advisors to 
operate more efficiently. 

As mentioned above, the Legal Division now also encompasses policy development, which stems from 
one of the DPC's new obligations under the GDPR to promote awareness and understanding among 
organisations and the public of the risks, rules, safeguards and rights in relation to processing of 
personal data. An additional resource is required at AO level to assist in policy development and 
research tasks under the Guidance and Policy Development Unit in order to build overall capacity of 
this unit and meet the increased demands on the DPC from data controllers and data subjects alike to 
produce detailed, robust guidance and policy positions, while further staff at CO level are required to 
assist the Legal team as a whole with a wide variety of scheduling and administrative tasks. 
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Breaches, Complaints, Investigations & Transfer Division 


Due to the increase in the number and complexity of complaints since the new legal regime was 
introduced, as set out earlier in this submission, it is necessary to ensure that the complaint handling 
and investigation units are adequately resourced. Additional staff are required particularly at HEO 
level. They will be responsible for complaint case management in addition to leading the more 
complex and multi-faceted investigations, many of which will require a formal decision of the 
Commission. The HEOs will manage teams of EOs who will be responsible for the complaint handling 
and investigation of more routine complaints and seeking to resolve the complaint through the 
amicable resolution process. In addition COs are required for general logging and the multitude of 
administrative tasks across all the complaint handling units. 

The Special Investigations Unit (SIU) has seen its work expand and requires further investigators at 
HEO level who will be responsible for large and complex investigations into infringements across the 
private and public sector. 

Cross-Border Data Transfers - The GDPR formalised the process of cross-border data transfers, some 
of which are carried out under the Binding Corporate Rules process. It involves the Lead Data 
Protection Authority (i.e. the DPC in many cases) having to assess the proposals of the company, lead 
the process of consultation with other DPAs and then make recommendations to the EDPB though 
the consistency mechanism of the GDPR. The DPC has already seen a substantial increase in the 
number of companies which are applying to have it as their Lead Authority, and this will increase 
dramatically if there is a no-deal Brexit. 
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Corporate Affairs, Communications and Information & Assessment Unit 

Section 25 of the Data Protection Act, 2018 requires that the DPC transition to become its own 
accounting officer, envisaged to be effective from 1 January 2020, with this transition having a 
significant impact on the administrative and fiduciary obligations of the DPC including HR, finance, 
procurement, governance, IT, and corporate services. Accordingly, the Corporate Affairs Division 
requires senior hires to meet the new management, operational, reporting and transparency 
obligations as part of the Accounting Officer impact. 


As part of the Accounting Officer obligations, the Finance Unit will require additional professional 
internal resources to assist with the increased fiduciary obligations of being a vote-holding body in 
particular the monthly reporting via the DJE group of votes, ensuring payroll processes are completed 
and correct, engaging with the Oireachtas Committee of Public Accounts (PAC) and other external 
queries. 


The Division also requires additional resources to ensure effective operational performance, 
compliance with statutory obligations as an employer and public body, and stringent assurance 
oversight relating to value for money considerations. For example, a new Head of IT Assurance is 
required to ensure that: the DPC is itself delivering its obligations as a data controller of personal data; 
the DPC is achieving value for money in its ICT services; the DPC's IT strategy and investment 
programme is coherent and future-proof; the DPC's information security, business continuity and IT 
risks are rigorously assured and actively managed; the DPC DPO's assurance and interventions are 
supported and implemented; and DPC staff have all the ICT supports they need to deliver their 
functions. 


Other resources will be required for HR-related services management, procurement, corporate 
governance and other administration. 
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Table 2 - Summary of Budget 2020 DPC Additional Staffing Requirement by Grade 


2020 Additional Staffing Requirement 
(Assuming achievement of total staffing of 148 at end 2019) 


Grade 

2020 Additional 
Staffing 
Requirement 

Total DPC 
Projected 
Staffing 
(by end 2020) 

Commissioner 

- 

1 

PO 

2 

8 

AP 

11 

48 

HEO 

27 

70 

AO 

1 

8 

EO 

25 

58 

CO 

10 

31 

Total 

76 

224 


The above proposed level of staffing will be a critical enabler of the DPC to perform its significant 
Regulatory role under the GDPR and the Law Enforcement Directive, and to bring the DPC more into 
line with staffing levels at other prominent data protection authorities within the EU. It should be 
noted that this staffing proposal does not take full account of the DPC's likely expected staffing 
requirements in the context of the EU Proposal for an ePrivacy Regulation which is currently being 
negotiated at EU level. The ePrivacy Regulation is expected to have an extensive impact on the 
workload of the DPC, but it will only be possible to undertake a detailed analysis of the consequent 
workload when the final text of the Regulation has been adopted. 
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2.2 Non-pay allocation requirement 2020 


With regard to the DPC's non-pay funding requirement, in 2020 the DPC has projected that it will 
require non-pay funding of C7.803M, an increase of C1.439M, or 23%, from C6.364M which was 
allocated in Budget 2019. 


The projected non-pay costs in 2020 is substantially attributable to the following areas: 

(a) Accommodation related costs 

The DPC continues to engage intensively with the Office of Public Works to source a permanent 
accommodation solution for the DPC's Dublin staff, a process which has been ongoing since November 
2016. The DPC's Dublin head office, a state-owned building located at 21 Fitzwilliam Square, exceeded 
full capacity in Q2 2017. Since then two separate and consecutive temporary accommodation 
arrangements, which were necessary to allow for the continuing growth of the DPC, were secured at 
serviced accommodation facilities on Harcourt Street and subsequently at Trinity Point on Leinster 
Street. As a result, since Q2 2017 the DPC has been divided across two Dublin locations, in addition to 
the Portarlington office. 

The need for a fit-for-purpose permanent city-centre Dublin head office, reflecting international 
stakeholders' expectations of the DPC and which is capable of housing all current and future Dublin- 
based staff, has been a critical requirement for some time. The urgency of a new premises arises in 
particular from the constant national and international media focus and negative commentary on the 
standard and location of the DPC's offices, as well as from the significant costs of maintaining 
temporary office locations as the DPC continues to expand in size and the operational impact for the 
DPC of operating across multiple locations. 

Notwithstanding the current highly constrained Dublin office property rental market, a potentially 
suitable permanent premises to accommodate the DPC's Dublin based staff has now been identified 
and work is underway by the OPW to urgently conclude all necessary evaluations with a view to 
entering into lease negotiations. It is anticipated that the property concerned will be available for 
occupation by late 2020. 

The DPC non-pay allocation has been increased to take account of the costs associated with the initial 
lease, fit-out and other costs that are likely to arise in 2020, subject to a lease being be successfully 
secured in respect of the preferred location and the necessary expenditure sanctions obtained. It 
should be noted that the apportioning of fit-out costs between the DPC and the OPW has yet to be 
discussed with the OPW so the extent to which the financial burden of fitting out a new building will 
fall to the DPC has yet to be determined. 

Additional funding provision is also being sought for additional temporary accommodation to take 
account of the continuing expansion of the DPC and to bridge the gap between current 
accommodation space reaching full capacity in 2020 and occupation of a new premises. 

In total the DPC is seeking provision of C2.450M for accommodation related costs, an increase of 
C0.760M on 2018. 
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(b) Legal costs 2020 

General Comment on litigation involving the DPC 

Legal costs continue to comprise a very substantial proportion of the DPC's non-pay expenditure. The 
DPC's experience is that this is due to several factors in recent years including an increased public 
awareness of data protection rights leading to increased levels of complaints (as detailed elsewhere 
in this submission). This in turn has led to increased levels of statutory appeals and judicial review 
proceedings taken by complainants in connection with statutory decisions made by the DPC on 
complaints and in relation to the handling of complaints. In particular, there continues to be a trend 
towards increasing levels of litigation pursued by litigants-in-person and also applications by litigants 
in proceedings where the DPC is not named as a party, to subsequently involve the DPC in those 
proceedings (for example by way of applications to the Court to compel the joinder of the DPC to a 
specific case) even where the subject matter of the litigation does not primarily concern data 
protection issues. Every such case or application requires the DPC to be represented in the 
proceedings and to defend any such application, appeal or judicial review because if the DPC were not 
to do so, in most cases the undefended application would likely be granted or judgment would be 
made in favour of the party pursuing the litigation. 

With the advent of the GDPR (and Data Protection Act 2018 to give further effect in Ireland to the 
GDPR), the DPC anticipates that the existing patterns of increasing levels of individual complaints since 
25 May 2018 will continue to produce a correlative ongoing increase in litigation arising from 
individual case handling of such complaints. The Data Protection Act 2018 allows for a concurrent right 
of appeal against legal binding decisions of the DPC to either the Circuit Court or the High Court with 
a further appeal on a point of law to the Court of Appeal. The DPC's experience of regulating under 
the previous legislative regime (the Data Protection Acts 1988 and 2003) has been that appeals which 
are brought initially to the first appeal forum (which was the Circuit Court under that legislation), 
frequently do not conclude at that point, and where the appellant is unsuccessful at the first stage, 
further appeals to the next superior court are taken, with the possibility for proceedings to be the 
subject of ongoing appeals up through the judicial system to the Supreme Court. Such a sequence of 
appeals includes the possibility that an Irish Court may decide, of its own volition, to make a reference 
to the Court of Justice of the EU (CJEU), as has been the case in two sets of proceedings to which the 
DPC was a party in the last 5 years [Nowak v Data Protection Commissioner - Case C-434/16 and 
Schrems v Data Protection Commissioner - Case C-362/14]). Accordingly, in light of the inherently 
uncertain nature of litigation, and the impossibility of predicting the number of cases in which the DPC 
could be involved in any given year (and how complex, time consuming and elongated they will be), 
the DPC considers that it is essential that its budget continues to allow it sufficient capacity to respond 
to and defend itself in such litigation. This particularly so, having regard to the importance of enabling 
the DPC to bring its specialist knowledge and expertise to bear in the judicial process in order to assist 
and inform the relevant Court in its application of this niche area of law. Being able to comprehensively 
defend such proceedings is also critical to the DPC's ability to safeguard its regulatory reputation and 
ensure that public and media understanding of data protection law, arising from data protection 
litigation, is accurate. 

In addition to litigation where the DPC is subject (as a defendant or respondent) to an appeal, 
application to join it to a case, or in a judicial review of its activities, amongst other legal action, the 
DPC also continues to pursue prosecutions against organisations for breaches of data protection law, 
particularly in relation to the specific E-Privacy rules (S.l. 336/ 2011). This continues to be an important 
limb of the DPC's enforcement activities and the DPC's experience has been that the continuing media 
coverage of such prosecutions helps to drive awareness amongst organisations of their obligations in 
this specific area. 
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Litigation arising from interpretative and novel legal issues 


Aside from litigation arising from cases where the subject matter of a case is centred on individual 
complaint issues, a large proportion of the DPC's legal expenditure in recent years has been 
attributable to the high profile proceedings which were taken in 2016 by the DPC, following the 
directions of the Court of Justice of the EU (CJEU) from an earlier case. In these proceedings [Data 
Protection Commissioner v. Facebook & Schrems, Case C-311/18], brought before the Irish High Court 
(Commercial List), the DPC sought a reference to the CJEU in relation to the validity under EU law of 
Standard Contractual Clauses, which are a mechanism for effecting international data transfers 
established under a number of EU Commission Decisions. The DPC was mandated to take those 
specific proceedings, in line with the directions of the CJEU set out in a judgment from 2016 [Schrems 
v Data Protection Commission, Case C-362/14, paragraph 65], in the particular circumstances of its 
investigation into the specific type of complaint at issue. That case raised exceptionally complex and 
novel issues of EU data protection law and its intersection with US law (as it concerned the issue of 
personal data transfers from the EU to the USA). The case is of fundamental importance to the 
determination of core issues of data protection under EU law and has drawn global media coverage 
and worldwide interest far beyond the data protection community. The case is now in its final stages 
with the reference made by the Irish High Court to the CJEU now due to be heard by the CJEU on 9 
July 2019. Accordingly, a significant proportion of the DPC's legal costs for 2019 will also be directly 
attributable to these proceedings. 

While these proceedings are now approaching completion, the possibility remains for other litigation 
to arise during 2020 where references will be made to the CJEU by the Irish Courts, whether of their 
own volition on a point of law concerning novel aspects of the GDPR and the application of the Data 
Protection Act 2018, or at the request of the DPC, where it considers that the binding directions of the 
CJEU requiring it to seek a referral through the national courts to the CJEU apply. As we are only one 
year into an entirely new EU legal regime under the GDPR with completely novel and untested legal 
mechanisms established under the GDPR, there remain many procedural uncertainties as to how the 
EU level obligations and requirements (for example in relation to the functions of the newly created 
European Data Protection Board (the EDPB), which consists of all the data protection authorities in 
the EEA and which is a body of the EU) must be applied and take effect at a practical level. 

One of the areas of particular legal uncertainty concerns the interactions and legal relationships 
between member state data protection authorities such as the DPC, the EDPB and the CJEU arising 
from the One Stop Shop (OSS) procedure and the dispute resolution functions which the EDPB must 
perform. As the DPC is the lead supervisory authority under the OSS procedure in the GDPR for the 
many multinational and technology companies and internet platforms which have their European 
headquarters in Ireland, the DPC will play a lead role in investigating complaints and alleged 
infringements of data protection law against such entities. Under the OSS process, the DPC will also 
be responsible for drafting a decision and then, together with all other EEA data protection authorities 
which are concerned with the issue, reaching a consensus decision on the issue. That decision, while 
it will essentially be reached by way of a form of collective decision making, must be adopted and 
applied by the DPC against the company in question which means that any appeal against the decision 
will generally be taken in the Irish Courts, although there is also the possibility for the company which 
is affected by the decision in question to take an annulment action to the CJEU in certain 
circumstances. Equally there is the possibility that the Irish Courts, in considering an appeal against a 
decision of the DPC may decide to refer a specific matter to the CJEU for determination on a point of 
EU law. Where the DPC cannot achieve a consensus position on the decision amongst all of the data 
protection authorities concerned with a particular case then the dispute resolution mechanism at 
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EDPB level may be triggered and the outcome of that process is similarly subject to the possibility of 
an annulment action before the CJEU. It is therefore likely that there will be a considerable volume of 
litigation arising from the new operational impact of the GDPR during 2020 both at national Courts 
and CJEU level. 

Litigation arising from enforcement action under the GDPR and Data Protection Act 2018 

The DPC is a quasi-judicial, decision-making body, which can exercise high-impact corrective powers 
under the GDPR. These include both punitive measures such as administrative fines up to a ceiling of 
€20 million or 4% of the global annual turnover, as well as enforcement actions aimed at addressing 
data processing operations which infringe the law, such as temporary or indefinite bans on data 
processing or international data transfers. Given the potential for the exercise of the DPC's powers to 
have far-reaching consequences for organisations which are the addressees of such powers, the DPC 
anticipates that there will a wave of legal challenges as it begins to exercise its range enforcement 
powers against the entities that it regulates, particularly where it is imposing administrative fines. 
Such challenges may be pursued byway of the statutory appeal process set out in the Data Protection 
Act 2018, by way of judicial review proceedings, or otherwise. Accordingly, it is critical that the DPC 
has requisite funding to enable it to defend such litigation, the outcomes of which will be central to 
establishing legal certainty in relation to the implementation and application of the novel procedural 
mechanism established under the GDPR and the Data Protection Act 2018. 

Legal advisory services 

During 2018 and moving into 2019, the DPC has continued to require a substantial level of expert legal 
advice from external legal advisors, including junior and senior counsel on a diverse range of issues. 
These requirements have arisen to a large extent as a result of the new legal regime under the Data 
Protection Act 2018 and the GDPR and the interaction between those two laws in particular. Advices 
have been sought in connection with both specific issues arising in individual cases and at a higher 
interpretative level as the DPC has sought to establish and define the new regulatory and enforcement 
processes which it must apply. Given the complex interactions between the principles based nature 
of the law set out in the GDPR and the more granular processes applicable to the DPC as the Irish 
regulator for data protection law, a considerable proportion of the advices which the DPC has 
required, and will continue to require into the foreseeable future, will relation to the application of 
EU law and its interplay with national administrative law and the Data Protection Act 2018. Such advice 
is central is the DPC's discharge of its complaint handling, investigatory and enforcement obligations 
under the GDPR and in assisting the DPC to continue to inform, educate and drive awareness amongst 
data controllers and processors as to how the GDPR applies and will be enforced by the DPC. 

Reguirement in respect of 2020 Legal Costs 

In respect of 2019, €2 million has been allocated to DPC's legal costs. At this point in 2019, a large 
proportion of the DPC's 55 major investigations into systemic processing operations by controllers 
who process the personal data of millions of data subjects is significantly advanced. To the extent that 
such investigations will ultimate culminate in decisions taken by the DPC imposing enforcement action 
and corrective powers such as the imposition of administrative fines, the DPC expects - as noted above 
-that there will be the first wave of litigation (arising from legal challenges to such action) materialising 
towards the third quarter to the end of 2019 and that this will continue throughout 2020. As such, it 
is difficult to predict how much of the DPC's legal budget for the current year will remain unused. 
However even if a proportion of that budget remains unutilised during 2019, the DPC expects that the 
demand for legal services, arising from both litigation and the need for advisory services, will be greatly 
increased in 2020 as the DPC's current major investigations crystallise, in many cases, into 
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enforcement action and that action is challenged through the Irish Courts, including with the potential 
for cases to be referred to the CJEU. Accordingly, the DPC seeks equivalent funding of € 2 million in 
respect of its anticipated 2020 legal costs. 


(c) ICT costs 

The DPC expects that almost C0.906M will be required to cover its ICT costs in 2020, which represents 
an increase of almost C0.176M or about 24% over its 2019 projected ICT expenditure. This net increase 
comprises the following main elements. 

The Department of Justice and Equality provides the DPC with its ICT services, for which the DPC has 
been cross-charged by the Department on a per-user basis, commencing in 2019. Given that the DPC 
anticipates increased staffing levels in 2020, the total cross-charge will increase accordingly, by an 
estimated C0.065M. 

During 2018, the DPC commenced significant multi-year projects to replace its case management 
systems and website, in anticipation of the increased volumes and complexity related to the 
implementation of the GPDR, with those projects continuing in 2019. From 2020, the DPC will incur 
increased support, licensing, security and hosting charges related mainly to those systems. The DPC 
will also continue to invest in its IT Lab facilities to allow for rigorous and objective testing of 
technology related to the DPC's investigatory work. These increases are estimated to total 
approximately C0.170M. 

However, the DPC expects that there will be reduction in costs of about C0.060M, compared with 2019 
projections, related to the introduction of new software packages that the DPC requires to fully 
prepare for becoming its own accounting officer and vote holder. 


(d) DPC 2020 strategic projects 

During 2018 and 2019, the DPC commenced several strategic projects, with many of these projects 
continuing in 2020 to ensure the target benefits are fully realised. Further new projects will also 
commence in 2020, to ensure that the DPC continues to consolidate its operational performance and 
effectiveness. Compared with 2019, the total net increase in expenditure on strategic projects is 
expected to be about C0.027M. 

Significant projects that will continue in 2020 include the DPC's multi-year programme to implement 
a new website and case management systems, with Phase 2 of that programme due for 
implementation in 2020. Phase 2 will ensure that the full benefits of the DPC's investment to date are 
realised, particularly on management information reporting and key performance indicators. 

The DPC's project on records management will also continue in 2020. Further consolidation of the 
DPC's management of its finance and HR services will also take place during 2020, following the DPC's 
transition to its own accounting officer. The DPC will also undertake an extensive IT strategy to ensure 
its core IT systems and ICT services are sustainable and future-proof. 

Further phases of the DPC's Regulatory Strategy, Data Protection Officer Network and Children's 
Consultation projects will also continue in 2020, with the policy and operational implementation of 
changes identified during 2019. 
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(e) Increased DPC training Costs 


The DPC's funding requirement for training will increase significantly in 2020, in light of the ongoing 
increases in staff, the broad range of entirely new functions, powers and procedural mechanisms of 
the DPC under the GDPR and the Data Protection Act 2018 and the evolving legal and regulatory 
climate within which the DPC works. As developments in data protection law and practice, in EU law 
and more generally in terms of the application of national administrative law and fair procedures 
occur, there is a continuing requirement for training to be delivered in these areas across the large 
number of the DPC's staff who perform substantive regulatory functions. The broad suite of extensive 
investigatory powers (including new authorised officer powers) which the DPC has acquired under the 
Data Protection Act 2018 mean that the specialist staff exercising such powers will require expert 
external training in niche and novel areas, particularly where the powers in question are unique to the 
DPC. Given that data protection regulation, by its nature, requires ongoing assessment of emerging 
technologies and novel usages of personal data, there will also be a requirement to ensure that 
relevant staff receive continuing training in technological issues. The vast majority of these types of 
specialist training needs which arise due to the specific remit of the DPC as a regulator will have to be 
delivered by way of external expert trainers and facilitators, in many cases through courses and 
programmes which are bespoke and tailored to reflect the DPC's unique role, powers and functions. 

More generally, the DPC's requirement for significantly increased funding for training purposes from 
1 January 2020 onwards derives from the change to the DPC's status where it will become its own 
accounting officer from that date. This means that the responsibility to deliver adequate training 
programmes to support the training, development and knowledge enhancement of DPC staff will rest 
solely with the DPC, becoming a newly acquired responsibility of the DPC as its own accounting officer. 
This represents a significant departure from the position prior to that date where the funding 
requirements for a large proportion of the training programmes which DPC staff benefitted from were 
discharged by the Department of Justice and Equality (DOJE) in its role as the employer of DPC staff 
(who up until 1 January 2020 will be staff of the DOJE assigned to the DPC). However, as of 1 January 
2020, the DPC will become the employer of those staff and therefore acquire the financial 
responsibility for covering the costs of any training programmes in which DPC staff participate. This 
will include the delivery of all relevant training programmes on non-data protection specific areas, but 
which arise by virtue of the competencies and roles which the DPC's staff must perform as Civil 
Servants e.g. management, leadership training etc., as well as training required for operational 
delivery (e.g. customer service, project management, IT and communications courses). Such training 
in IT and soft skills is available from OneLearning in certain cases, and these programmes and courses 
for DPC staff delivered through OneLearning have previously been paid for by the DOJE out of its 
central training fund. 

Accordingly the DPC's requirement for funding for staff training will be greatly enlarged for 2020. The 
DPC's ability to deliver appropriate and timely training to its staff is critical to the DPC's continuing 
capacity to perform its functions and exercise its powers in an efficient, expert and professional 
manner. 

(f) Other operational costs 

Finally, as the DPC grows in size from an organisation of c. 130 staff at the end of 2018 and 148 staff 
at the end of 2019 and expected 223 staff by the end of 2020, the DPC's general operational, 
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administrative and travel and subsistence costs will grow, associated with a larger workforce. These 
are set out in Appendix 2. 


3. Conclusion 

The Data Protection Commission acknowledges the commitment of Government over recent years to 
increase the level of funding and staff allocation to the DPC. The Government priority placed on 
appropriately funding the DPC recognises the central and globally-significant role that DPC must play 
as one of the world's leading data protection regulators. 

As the new regulatory framework under the GDPR and the Law Enforcement Directive take full effect 
in the coming years, and in light of the DPC's central role within this new EU regulatory system, it is 
important that Government maintains its commitment to ensuring that the DPC is appropriately 
funded and resourced to carry out its EU-wide regulatory functions. 

In respect of 2020, the DPC is seeking additional funding of C5.914M (C4.475M pay and C1.439M non¬ 
pay allocations respectively). The total financial allocation sought is C21.194M (comprising total pay 
allocation of C13.391M and non-pay allocation of C7.803M.) 
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Appendix I - DPC Budget Allocation & Staffing Summary 2016 to 2019 
and proposed 2020 allocation 

Table 3 - DPC Budget Allocation 2016 to 2019 and proposed 2020 allocation 


DPC Budget Allocation 2016-2019 (ind. proposed 2020) 


2016 

2017 

2018 

2019 

2020 Proposal 


(m) 

(m) 

(m) 

(m) 

(m) 

Pay 

3.334 

5.162 

7.305 

8.916 

13.391 

Non-Pay 

1.414 

2.364 

4.364 

6.364 

7.803 

Total 

4.748 

7.526 

11.669 

15.280 

21.194 


Table 4 - DPC Staffing Levels 2016 to 2019 (including proposed 2020) 


DPC Staffing Levels 2016-2019 (incl. proposed 2020) 


2016 

2017 

2018 

2019 

2020 Proposal 

Number of Sanctioned Staff 

61 

96 

138 

180 

224 

Number Appointed 

52 

75 

101 

132* 

- 

% Increase from previous year 

33% 

57% 

44% 

30% 

- 


* (as @ mid-June 2019) 


Appendix II - DPC Budget 2020 Submission 

Attached spreadsheet 1 - 2020 Budget Submission 
Attached spreadsheet 2 - 2020 Salary Estimates 
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Appendix III 

Human Rights and Equality Statement 


The Human Rights and Equality Commission Act 2014 with specific reference to Section 42 ('the Act') 
sets out that public bodies in the performance of all of their functions should have regard to human 
rights and equality. 

The DPC has considered the necessary human rights and equality factors to ensure the organisation 
fulfils its duty under the Act in consideration of the DPC's budgeting requirements. In line with the 
Irish Human Rights and Equality Commission (IRHEC), the DPC will follow the below recommended 
approach to ensure a proactive and systematic approach to plan and address human rights and 
equality in our budgetary process; 


Point 3 


Issues 

Actions 

• Need to apply equality and human rights lens 

• Undertake a review of budgetary procedures 

to organisational budgets 

with a view to integrating equality and human 
rights considerations. 

• How to reflect equality and human rights in 
procurement? 

• Review procurement processes, clarify sub¬ 

contractor responsibilities, develop guidelines 

• How to promote equality and human rights in 

• Applying equality and human rights 

granting funds to other organisations? 

considerations to grants making function 


(Source: Irish Human Rights and Equality Commission) 


Additional information can be obtained at https://www.ihrec.ie/. 
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